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GUIDE FOR INDIVIDUALS 


Your Privacy 
Rights 


Canada’s Personal 
Information Protection and 
Electronic Documents Act 


Introduction 


he Office of the Privacy Commissioner of Canada has prepared this guide 
to help individuals learn about their rights under the Personal Information 
Protection and Electronic Documents Act (PIPEDA), Canada’s new private 


sector privacy law. 


What is PIPEDA? 


Part 1 of PIPEDA sets ground rules for 
how organizations may collect, use or 
disclose information about you in the 
course of commercial activities. The 
law also gives you the right to see 
and ask for corrections to informa- 
tion an organization may have col- 
lected about you. If you think an 
organization covered by the Act is 
not living up to its responsibilities 
under the law, you have the right to 
lodge an official complaint. 


What is personal 
information? 


“Personal information” under the Act 
means information about an “identifi- 
able individual.” 


For example, “personal informa- 
tion” includes your: 


™ name,age, weight, height; 

® medical records; 

@ income, purchases and spending 
habits; 

® race,ethnic origin and colour; 

# blood type, DNA code, finger- 
prints; 

™ marital status and religion; 

B® education; and 

m home address and phone number. 


“Personal information” does not 
include the name, job title, business 
address or office telephone number 
of an employee of an organization. 


How does the Act 
protect my personal 
information? 


Your ability to control your personal 
information is key to your right to 
privacy. 


The Act gives you control over your 
personal information by requiring 
organizations to obtain your consent 
to collect, use or disclose information 
about you. The Act confers certain 
rights on individuals, and imposes 
specific obligations on organizations. 


The law gives you the right to: 


@ know why an organization col- 
lects, uses or discloses your per- 
sonal information; 

® expect an organization to collect, 
use or disclose your personal infor- 
mation reasonably and appropri- 
ately, and not use the information 
for any purpose other than that to 
which you have consented; 

m@ know who in the organization is 
responsible for protecting your 
personal information; 

™ expect an organization to protect 
your personal information by tak- 
ing appropriate security measures; 

®™ expect the personal information 
an organization holds about you 
to be accurate, complete and up- 
to-date; 

® obtain access to your personal 
information and ask for correc- 
tions if necessary; and 


™ complain about how an organiza- 
tion handles your personal infor- 
mation if you feel your privacy 
rights have not been respected. 


The law requires organizations to: 


™ obtain your consent when they 
collect, use or disclose your per- 
sonal information; 

® supply you with a product ora 
service even if you refuse consent 
for the collection, use or disclosure 
of your personal information 
unless that information is essential 
to the transaction; 

® collect information by fair and law- 
ful means; and 

® have personal information policies 
that are clear, understandable and 
readily available. 


An organization should destroy, erase 
or make anonymous personal infor- 
mation about you that it no longer 
needs in order to fulfil the purpose 
for which it was collected. 


There are certain exceptions to these 
principles. For example, an organiza- 
tion may not need to obtain your 
consent if collecting the information 
clearly benefits you and your consent 
cannot be obtained in a timely way; 
or if the information is needed by a 
law enforcement agency for an inves- 
tigation, and getting consent might 
compromise the information’s 
accuracy. 


How can | see 
the personal 
information an 
organization 
has about me? 


m Senda written request to the 
organization that holds your per- 
sonal information. You must pro- 
vide enough detail to allow the 
organization to identify the infor- 
mation you want. For example, 
include dates, account numbers, 
and the names or positions of 
people you may have dealt with at 
the organization. 

™ Organizations must provide the 
information requested within a 
reasonable time and at minimal or 
no cost. 


How can | correct errors 
or omissions In my 
personal information? 


= Write to the organization that has 
personal information about you 
and explain the correction you are 
requesting and why. Supply copies 
of any documents that support 
your request, if you have them. 

m Ifthe organization refuses to cor- 
rect your personal information, 
you may require it to attach a 
statement of your disagreement 
to the file. This statement must be 
passed on to any other organiza- 
tion that may have access to the 
information. 


What if I believe my 
privacy rights are not 
being respected? 


The Act gives you the right to make 
a complaint if: 


you run into any difficulties 
obtaining your personal informa- 
tion, if an organization refuses to 
correct information you consider 
inaccurate or incomplete, or if you 
suspect your personal information 
has been improperly collected, 
used or disclosed; or 

you believe an organization is not 
following any provision of PIPEDA. 


Where do | complain? 


Contact the Office of the Privacy 
Commissioner of Canada by call- 
ing 1-800-282-1376 if you need 
more information or advice on 
how you should proceed. 

We encourage you to first try 

to settle the matter directly with 
the organization about which 
you are complaining by contact- 
ing the person responsible for 
handling privacy issues within 
the organization. 

If you are not satisfied with the 
organization's response, you may 
contact the organization’s industry 
association, ombudsman or com- 
plaint office, if there is one. For 
example, the Canadian Marketing 
Association and the Canadian 
Banking Ombudsman handle cus- 
tomers’ complaints about their 
member companies. 


If you are not satisfied with the 
way the organization or industry 
association handles the matter, 
contact the Office of the Privacy 
Commissioner of Canada. There is 
no fee for making a complaint to 
our Office. 


What is the role of the 
Privacy Commissioner 
of Canada? 


The Privacy Commissioner is an 
ombudsman who attempts to 
resolve disputes through negotia- 
tion, mediation and conciliation. 
The Commissioner has the power 
to investigate your complaint. 
The Commissioner may also initi- 


ate her own investigation or 


review regarding how an organi- 
zation handles personal informa- 
tion. 

The Commissioner can recom- 
mend that the organization 
release your personal information 
to you or correct any inaccuracies. 
The Commissioner may recom- 
mend to an organization that they 
change their personal information 
handling practices. 

The Commissioner will report the 
findings of the investigation to 
you and the organization. 


What if the 

organization ignores the 
recommendations of the 
Privacy Commissioner? 


m The Privacy Commissioner has the 
power to make public any infor- 
mation about the personal infor- 
mation handling practices of an 
organization. Few organizations 
would like to be publicly identified 
as having violated the privacy 
rights of individuals. 

= The Privacy Commissioner may 
also take the complaint to the 
Federal Court of Canada on your 
behalf if she supports you, but 
has been unable to resolve the 
dispute. 

m™ Once you have received the 
Privacy Commissioner's report you 
may, under certain circumstances, 
take your complaint to the Federal 
Court of Canada yourself. 


For more information 


if you have any questions about how 
an organization handles your per- 
sonal information or wish to make a 
complaint under the new law, please 
contact us at: 


Office of the Privacy Commissioner 
of Canada 

112 Kent Street 

Ottawa,ON K1A1H3 

Telephone: (613) 995-8210 


Toll-free: 1-800-282-1376 
Fax: (613) 947-6850 
Web site: § www.privcom.gc.ca 
E-mail: info@privcom.gc.ca 


m The Court can order an organiza- 
tion to correct any practices that 
do not comply with the law, and to 
publish notices of how it has or 
will correct its practices. 

m= The Court can also award dam- 
ages to the complainant, including 
damages for humiliation suffered. 


What is not covered 
by PIPEDA? 


m Any federal government organiza- 
tion already covered by the Privacy 
Act 

® Provincial or territorial govern- 
ments, and their agents 

m™ Any organization that collects, 
uses or discloses personal infor- 
mation solely for journalistic, 
artistic or literary purposes 

® An individual's collection, use or 
disclosure of personal information 
for personal purposes, such as 
genealogical research shared with 
other family members 


Please do not make complaints or 
provide personal information by e- 
mail, as security cannot be ensured. 


Note that this brochure summarizes 
the law. As such, it has no legal status. 
To obtain the full text of P/PEDA, visit 
our Web site or contact the Office of 
the Privacy Commissioner of Canada. 
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Cette publication est disponible également 
en francais. 


® Sil'organisation refuse de corriger vos 
renseignements personnels, vous pou- 
vez l’obliger a joindre a votre dossier 
une note indiquant votre désaccord. 
Cette note doit étre transmise a toute 
autre organisation ayant accés a |'in- 
formation. 


Que dois-je faire sije 
crois que mes droits 
a la protection de 
mes renseignements 
personnels n’ont pas 
été respectes? 


La Loi vous donne le droit de 
porter plainte : 


® si vous éprouvez des difficultés a 
obtenir vos renseignements person- 
nels, si une organisation refuse de 
corriger l'information que vous jugez 
inexacte ou incomplete ou si vous 
croyez que vos renseignements per- 
sonnels ont été recueillis, utilisés ou 
communiqués de facon inappropriée; 

B si vous Croyez qu'une organisation 
ne respecte pas les exigences de 
la LPRPDE. 


Comment pourrais-je 
déposer ma plainte? 


& Si vous avez besoin de plus de ren- 
seignements ou de conseils, commu- 
niquez avec le Commissariat a la 
protection de la vie privée du Canada, 
au 1 (800) 282-1376. 

® Nous vous suggérons d’essayer 
d’abord de régler votre plainte 
directement avec l'organisation 
concernée en communiquant avec 
la personne responsable de traiter 
les plaintes relatives a la protection 
de la vie privée. 


m Si vous n’étes pas satisfait de la 
réponse obtenue, vous pouvez com- 
muniquer avec l’association commer- 
ciale, l'ombudsman ou le bureau des 
plaintes de l’organisation, s'il y a lieu. 
Par exemple, ‘Association canadienne 
du marketing ou l’ombudsman ban- 
caire canadien donnent suite aux 
plaintes portées par des consomma- 
teurs contre leurs entreprises ou 
compagnies membres. 

m Si vous n’étes pas satisfait du traite- 
ment de votre plainte, communiquez 
avec le Commissariat a la protection 
de la vie privée du Canada. Aucuns 
frais ne sont exigés pour le dépét 
d'une plainte auprés du Commissariat. 


Quel est le role de 
la Commissaire ala 
protection de la vie 
privée du Canada? 


= LaCommissaire ala protection de la 
vie privée du Canada est un ombuds- 
man qui tente de régler les différends 
au moyen de la négociation, la média- 
tion et la conciliation. 

@ Elle ale pouvoir faire enquéte sur 
votre plainte. 

® Elle peut aussi prendre l’initiative 
d'une enquéte ou d’un examen rela- 
tivement a la pratique d’une organisa- 
tion en matiére de gestion des 
renseignements personnels. 

= LaCommissaire peut recommander 
que l’organisation vous donne accés a 
vos renseignements ou corrige toute 
erreur. 

= LaCommissaire peut formuler des 
recommandations a l'intention d’une 
organisation pour qu’elle modifie ses 
pratiques de gestion des renseigne- 
ments personnels. 

® Elle fait rapport sur les conclusions de 
enquéte a vous et a l’organisation. 


Que se passe-t-il si 

l’organisation ne 

tient pas compte des 

recommandations 

de la Commissaire 

ala protection de 

la vie privée? 

@ LaCommissaire ale pouvoir de rendre 
publique toute information relative 
aux pratiques d’une organisation en 
matiére de gestion des renseignements 
personnels. Peu d’entreprises désirent 


étre citées comme étant des organisa- 
tions qui ne respectent pas les droits a 


la protection de la vie privée des individus. 


&# LaCommissaire peut également, en 
votre nom, demander d’étre entendue 
par la Cour fédérale du Canada, si elle 
vous appuie, mais qu'elle a été inca- 
pable de résoudre le différend. 

® Une fois que vous avez recu le rapport 
de la Commissaire a la protection de la 
vie privée, vous pouvez, dans certaines 
circonstances, déposer une plainte 
auprés de la Cour fédérale du Canada. 


@ La Cour peut ordonner a une organi- 
sation de corriger les pratiques qui ne 
sont pas conformes a la loi et de pub- 
lier des avis sur les mesures qu'elle a 
prises ou qu'elle prévoit prendre a cet 
égard. 

@ La Cour peut aussi accorder au plaignant 
des dommages- intéréts, notamment 
en réparation de I'humiliation subie. 


Qu’est-ce qui n’est pas 
visé par la LPRPDE? 


B Les institutions fédérales déja assujet- 
ties a la Loi sur/a protection des ren- 
seignements personnels 

m Les gouvernements provinciaux et ter- 
ritoriaux et leurs délégués 

® Lacollecte,!’utilisation ou la communi- 
cation de renseignements personnels 
par une organisation a des fins stricte- 
ment journalistiques, artistiques ou 
littéraires 

# Lacollecte, l'utilisation ou la communi- 
cation de renseignements personnels 
a des fins personnelles, comme les 
recherches généalogiques partagées 
avec d'autres membres de la famille 


Pour plus de renseignements 


Si vous avez des questions sur la facon 
dont une organisation du secteur privé 
traite de vos renseignements personnels, 
ou si vous désirez déposer une plainte 
dans le cadre de la nouvelle loi, veuillez 
communiquez avec le Commissariat. 


Le Commissariat a la protection 
de la vie privée du Canada 

112, rue Kent 

Ottawa (Ontario) K1A 1H3 
Téléphone: (613) 995-8210 


Sans frais: 1 (800) 282-1376 
Télécopieur : (613) 947-6850 
SiteWeb: www.privcom.gc.ca 
Courriel: — info@privcom.gc.ca 


En vue d’assurer la confidentialité de vos 
renseignements personnels, veuillez ne pas 
avoir recours au courrier électronique pour 
expédier des plaintes ou pour communi- 
quer des renseignements personnels. 


Il convient de noter que cette brochure est 
un résumé de la loi. Elle n’a donc aucune 
valeur juridique. Pour obtenir le texte inté- 
gral de la LPRPDE, consultez notre site Web 
ou communiquez avec le Commissariat. 
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Introduction 


e guide a été préparé par le Commissariat a la protection de la vie privée du Canada 

afin d‘informer les individus de leurs droits en vertu de la nouvelle loi canadienne sur 

la protection des renseignements personnels s‘appliquant secteur privé, soit la Lo/ sur 
la protection des renseignements personnels et les documents électroniques (LPRPDE). 


Qu’entend-on par LPRPDE? 


La Partie | de la LPRPDE établit des régles 
de base sur la fagon dont les organisa- 
tions peuvent recueillir, utiliser ou com- 
muniquer des renseignements a votre 
sujet dans le cadre d’activités commer- 
ciales. La loi vous donne aussi le droit de 
consulter les renseignements qu’une 
organisation a recueillie a votre sujet 

et de demander quiils soient corrigés. 

Si vous estimez qu'une organisation 
assujettie a la LPRPDE ne s'acquitte pas de 
ses obligations aux termes de la loi, vous 
avez le droit de porter plainte officiellement. 


Qu’entend-on par 
« renseignements 
personnels »? 


En vertu de la Loi,on entend par 

« renseignements personnels » tout 
renseignement au sujet d’un 

« individu identifiable. » 


Par exemple, les « renseignements 
personnels » comprennent : 


# votre nom, age, poids, grandeur; 

B® vos dossiers médicaux; 

® votre revenu, vos achats et vos 
habitudes de consommation; 

# votre race, votre origine ethnique 
et la couleur de votre peau; 

@ votre groupe sanguin, vos empreintes 
genétiques et vos empreintes digitales; 

# votre état matrimonial et votre religion; 

votre niveau d’instruction; 

= votre adresse domiciliaire et numéro 
de téléphone. 


Les « renseignements personnels » ne 
comprennent cependant pas le nom et le 
titre d'un employé d’une organisation, ni 
’adresse et le numéro de téléphone de 
son lieu de travail. 


Comment la Loi protege- 
t-elle les renseignements 
personnels quime 
concernent? 


Votre capacité a contrdler vos renseigne- 
ments personnels constitue la clé de vos 
droits en matiére de protection de votre 

vie privée. 


La Loi vous permet d’exercer ce contréle 
en obligeant les organisations a obtenir 
votre consentement pour recueillir, 
utiliser ou communiquer des renseigne- 
ments vous concernant. La Loi donne des 
droits aux particuliers et impose des obli- 
gations précises aux organisations. 


La Loi vous donne le droit: 


B® deconnaitre les raisons pour 
lesquelles une organisation recueille, 
utilise et communique des renseigne- 
ments personnels a votre sujet; 

m de vous attendre a ce qu'une organi- 
sation recueille, utilise et communique 
les renseignements personnels a votre 
sujet de facon raisonnable et appro- 
priée, et qu’elle n’utilisera pas l’infor- 
mation a des fins autres que celles 
auxquelles vous avez consenties; 

® de savoir qui dans l’organisation est 
responsable de la protection de vos 
renseignements personnels; 


m de vous attendre a ce qu'une organi- 
sation protege vos renseignements 
personnels en prenant les mesures de 
sécurité qui s'imposent; 

™ de vous attendre a ce que les ren- 
seignements personnels qu'une 
organisation détient a votre sujet 
soient exacts, complets et a jour; 

m d’avoir acces aux renseignements per- 
sonnels vous concernant et au besoin 
de demander quiils soient corrigés; 

@ de déposer une plainte sur les pra- 
tiques de gestion de vos renseigne- 
ments personnels par une 
organisation, si vous jugez que vos 
droits au regard de la protection de la 
vie privée n’ont pas été respectés. 


Selon la Loi, les organisations : 


® doivent obtenir votre consentement 
lorsqu’elles recueillent, utilisent ou 
communiquent vos renseignements 
personnels; 

— ne peuvent vous refuser un produit 
ou un service si vous refusez votre 
consentement a la collecte, l'utilisation 
ou la communication de vos ren- 
seignements personnels, sauf si ceux- 
ci sont essentiels a la transaction; 

® doivent recueillir les renseignements 
de facon honnéte et licite; et, 

® doivent adopter des politiques en 
matiére de protection des renseigne- 
ments personnels qui sont claires, 
compréhensibles et faciles a consulter. 


Toute organisation devrait détruire, effacer 
ou dépersonnaliser les renseignements 
personnels recueillis a votre sujet s’ils ne 
sont plus nécessaires aux fins consenties. 


Ces principes prévoient des exceptions. 
Par exemple, il est possible qu’une organi- 
sation n’ait pas besoin de votre consente- 
ment si la collecte des renseignements est 
manifestement a votre avantage, et que 
votre consentement ne peut étre obtenu 


dans les délais requis; ou si les renseigne- 
ments sont requis par un organisme 
chargé de l'application d’une loi dans le 
cadre d'une enquéte et que lobtention 
du consentement risquerait de compro- 
mettre l’exactitude de l'information. 


Comment puis-je 
consulter les 
renseignements 
personnels qu’une 
organisation détient 
a mon sujet? 


m™ Enenvoyant une demande écrite a 
organisation qui détient vos ren- 
seignements personnels en question. 
Vous devez fournir suffisamment de 
précisions pour que l’organisation 
identifie de quels renseignements il 
s‘agit. Ainsi, par exemple inclure des 
dates, des numéros de compte ou le 
nom ou le titre des personnes avec 
lesquelles vous avez traité. 

# Les organisations doivent fournir les 
renseignements demandés dans un 
délai raisonnable et sans frais, sinon a 
un coat minime. 


Comment faire corriger 
les erreurs ou les 
omissions dans mes 
renseignements 
personnels? 


® En écrivant a l’organisation qui détient 
des renseignements personnels a 
votre sujet, en expliquant les correc- 
tions demandées et les raisons de 
votre demande. Envoyez, s'il y a lieu, 
copie de tout document susceptible 
de justifier votre demande. 
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A Word from the Privacy 
Commissioner of Canada 


he right to privacy is fundamental to any 
democratic society. If we have to worry — 
every time we open a bank account, use 
the Internet, make a purchase in a store or fill out 
a form — about who will see our personal informa- 
tion and how it will be used, we have lost a 
basic freedom. 


Protecting our privacy helps protect our chia soe 
independence, our ability to control our own lives, 

and our freedom to make our own decisions. Having control of our 
personal information is key to our privacy: the more others know about 
the details of our lives, the greater their opportunity to influence, interfere 
with or judge the choices we make. 


Advances in information technology and data management offer the 
promise of a new and prosperous knowledge-based economy. But this 
technology also poses a serious threat to our privacy. New communications 
and information systems allow organizations to gather, match, share and 
transmit growing quantities of information about us with unprecedented 
speed and efficiency. 


Finding a balance between the legitimate need of organizations to collect 
information about us and the necessity to protect our privacy is a major 
challenge. Canada’s Parliament responded to this challenge by passing a 
new law that applies to the private sector called the Personal Information 
Protection and Electronic Documents Act, which came into effect 

January 1,2001. 


My Office has prepared this brochure to answer some of the common 

questions Canadians may have about the new law and how to exercise 
. * . ae ie ‘a $ 

their right to privacy. cs * 
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Privacy Commissioner of Canada 
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What is the Personal Information 
Protection and Electronic 
Documents Act? 


art 1 of the Personal Information Protection and Electronic 

Documents Act sets down the ground rules for how 

organizations may collect, use or disclose information 
about you in the course of commercial activities. The law 
gives you the right to see and ask for corrections to informa- 
tion an organization may have collected about you. If you 
think an organization covered by the Act is not living up to 
its responsibilities under the law, you have the right to lodge 
an official complaint. 


What is personal information? 


“Personal information” under the Act means information 
about an “identifiable individual” 


For example, “personal information” includes your 


name, age, weight, height 

medical records 

income, purchases and spending habits 
race, ethnic origin and colour 

blood type, DNA code, fingerprints 
marital status and religion 

education 

home address and phone number 


“Personal information” does not include the name, 
job title, businesSudzess or office telephone number 


of an employes of ans ganization that is covered by 
thenewlaw. ; 


~ 
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How does the Act protect my 
personal information? 


Your ability to control your personal information is key to your 
right to privacy. 

The Act gives you control over your personal information by 
requiring organizations to obtain your consent to collect, use 
or disclose information about you. The Act confers certain 
rights on individuals, and imposes specific obligations on 
organizations. 


The law gives you the right to: 


= know why an organization collects, uses or discloses your 
personal information;* 

®™ expect an organization to collect, use or disclose your 
personal information reasonably and appropriately, and 
not use the information for any purpose other than that 
to which you have consented;* 

= know who in the organization is responsible for protecting 
your personal information; 

™ expect an organization to protect your personal informa- 
tion by taking appropriate security measures; 

™ expect the personal information an organization holds 
about you to be accurate, complete and up-to-date; 

= obtain access to your personal information and ask 
for corrections;* 

= complain about how an organization handles your 
personal information. 


The law requires organizations to: 


= obtain your consent when they collect, use or disclose 
your personal information;* 

= supply you with a product or a service even if you refuse 
consent for the collection, use or disclosure of your 
personal information unless the information is essential 
to the transaction;* 

= collect information by fair and lawful means; 

= have personal information policies that are clear, 
understandable and readily available. 


An organization should destroy, erase or make anonymous 
personal information about you that it no longer needs in 
order to fulfil the purpose for which it was collected. 


*There are exceptions to these principles. For example: 

an organization may not need to obtain your consent if 
collecting the information clearly benefits you and your 
consent cannot be obtained in a timely way; or if the 
information is needed by a law enforcement agency for an 
investigation, and getting consent might compromise the 
information's accuracy. 


How can | see the personal information 
an organization has about me? 


= Senda written request to the organization holding your 
personal information. You must provide enough detail to 
allow the organization to identify the information you 
want; for example, include dates, account numbers, 
and the names or positions of people you may have dealt 
with at the organization. 

= Organizations must provide the information requested 
within a reasonable time and at minimal or no cost. 


... over for more information 


What if the organization ignores the 
recommendations of the Privacy 
Commissioner? 


= The Privacy Commissioner has the power to make public 
any information about the personal information practices 
of an organization. Few businesses would like to be publicly 
identified as violating the privacy rights of individuals. 

= The Privacy Commissioner may also take the complaint to 
the Federal Court of Canada on your behalf if he supports 
you but has been unable to resolve the dispute. 

= Once you have received the Privacy Commissioner's report, 
you may, under certain circumstances, take your complaint 
to the Federal Court of Canada yourself. 

= The Court can order an organization to correct any 
practices that do not comply with the law, and to publish 
notices of how it has or will correct its practices. 

= The Court can also award damages to the complainant 
including damages for humiliation suffered. 


What is NOT COVERED by the Personal 
Information Protection and Electronic 
Documents Act? 


m Any federal government organization already covered 
by the Privacy Act. 

= Provincial or territorial governments, and their agents. 

= Any organization that collects, uses or discloses personal 
information solely for journalistic, artistic or literary 
purposes. 

® An individual's collection, use or disclosure of personal 
information for personal purposes, such as genealogical 
research shared with other 
family members. 


When does the Act come into force? 
The Act takes effect in three stages spread over three years. 


January 1, 2001 


At this stage, the Act applies to personal information about 
customers or employees (except “personal health informa- 
tion”) that is collected, used or disclosed by “federal works, 
undertakings or businesses” in the course of commercial 
activities. 


(Federal works, undertakings and businesses include 
organizations such as the banks, telephone companies, 
cable television and broadcasting companies, firms engaged 
in interprovincial transportation, and air carriers.) 


The Act also applies to personal information that is shared or 
disclosed for profit or any kind of benefit across the borders 
of Canada or a province, where the information itself is the 
subject of the transaction. 


The Act also covers all businesses and organizations engaged 
in commercial activity in Yukon, the Northwest Territories and 
Nunavut. 


January 1, 2002 

The Act will cover any “personal health information” collected 
by those organizations mentioned in the first stage. Personal 
health information is information about an individual's mental 
or physical health, including details about any tests, examina- 
tions and health services provided. 


January 1,2004 

The Act will cover the collection, use or disclosure of personal 
information in the course of any commercial activity within a 
province, including provincially regulated enterprises such as 
retail stores. The federal government may exempt organiza- 
tions and/or activities in provinces that have their own privacy 
laws that are substantially similar to the federal law. 


The Act will apply to all personal information in all interprovin- 
cial and international transactions by all organizations in the 
course of their commercial activities. 


How can | correct errors or omissions 
in my personal information? 


= Write to the organization that has personal information 
about you and explain the correction you are requesting 
and why. Supply copies of any documents that support 
your request, if you have them. 

= |f the organization refuses to correct your personal 
information, you may require it to attach a statement of 
your disagreement to the file. This statement must be 
passed on to any other organization that may have access 
to the information. 


What if I believe my privacy rights 
are being abused? 


The Act gives you the right to make a complaint if: 

® you run into any difficulties obtaining your personal 
information, if an organization refuses to correct informa- 
tion you consider inaccurate or incomplete, or if you 
suspect your personal information has been improperly 
collected, used or disclosed; 

= you believe an organization is not following any provision 
of the law. 


Where do! complain? 


= Contact the Office of the Privacy Commissioner of 
Canada during business hours by calling 1 800 282-1376 
if you need more information and advice on how you 
should proceed. 

m We encourage you to try to settle the matter directly with 
the organization about which you are complaining by 
contacting the person responsible for handling privacy 
issues within the organization. 

= If you are not satisfied with the organization’s response, 
you may contact the organization’s industry association, 
ombudsman or complaint office, if there is one. For exam- 
ple, the Canadian Marketing Association and the Canadian 
Banking Ombudsman handle customers’ complaints about 
their member companies. 

= If you are not satisfied with the way the organization or 
industry association handles the matter, contact the Privacy 
Commissioner of Canada. There is no fee for making a 
complaint to Privacy Commissioner. 


What is the role of the Privacy 
Commissioner of Canada? 


= The Privacy Commissioner is an ombudsman who attempts 
to resolve disputes through negotiation. 

= The Commissioner has the power to investigate your 
complaint. 

= The Commissioner may also initiate his own investigation 
or review how an organization handles personal information. 

= The Commissioner can recommend that the organization 
release your personal information to you or correct 
inaccuracies. 

= The Commissioner can recommend that organizations 
change their personal information practices. 

= The Commissioner will report the findings of the 
investigation to you and the organization. 


FOR MORE INFORMATION 


if you have any questions about how a private sector organi- 
zation handles your personal information or wish to make a 
complaint under the new law, please contact our office. 


The Office of the Privacy Commissioner of Canada 


112 Kent Street 
Ottawa, Ontario K1A 1H3 


Telephone: 1 (613) 995-8210 
Toll-free: 1 800 282-1376 


Fax: 1 (613) 947-6850 
Web site: © www.privcom.gc.ca 
E-mail: info@privcom.gc.ca 


Please note that this brochure summarizes the law. 

As such, it has no legal status. To obtain the full text of 
the law, consult our Web site or contact the Office of the 
Privacy Commissioner of Canada. 


Cette publication est disponible également en francais. 
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